Automated teller machines (ATMs) and similar devices typically use a two-factor authentication procedure to ensure the security of financial transactions. In two-factor authentication, a person seeking to engage in a secure transaction provides an item in two of three categories: something the person has, such as a debit card, something the person knows, such as a password, and something the person is, such as biometric information. For ATM transactions, the first factor is typically an ATM card or a similar card that is maintained in the possession of the person and that includes information encoded in a magnetic strip on the ATM card. The encoded information might include information about the card user's identity, information about the card user's bank account, or other information needed for a financial transaction. Such information will be referred to herein as account information. The second factor is typically a personal identification number (PIN) that is kept secret by the card user and that the card user enters into an ATM after inserting an ATM card into the ATM. If the PIN is appropriate for the account, the transaction is allowed to proceed. Any such second factor in a two-factor authentication procedure will be referred to herein as a PIN, but it should be understood that other types of information may be a used as a second factor.
Devices other than ATMs may use similar two-factor authentication procedures involving the entry of account information and a PIN. For example, the pumps at gas stations may accept a debit card for the entry of account information and the entry of a PIN on a keypad as a second factor. ATMs and unattended point-of-sale devices such as gas pumps typically use a central clearinghouse to manage transactions, thus allowing numerous different types of ATM cards, debit cards, or credit cards to be used in a single device. As used herein, the term “ATM” or “unattended point-of-transaction device” may refer to any such ATM or unattended point-of-sale device, and the term “ATM card” may refer to any card accepted by such a device. Also, while the discussion herein may focus on the withdrawal of cash from an ATM, it should be understood that similar considerations may apply to other types of ATM transactions and to obtaining other types of goods or services from other types of unattended point-of-transaction devices.